DeFi protocol Abracadabra lost $1.8 million after an attacker exploited a simple logic mistake in its batch function. Analysts at Hacken say the attacker already laundered funds via Tornado Cash.
Summary
- Abracadabra lost almost $2 million after an attacker exploited a simple logic mistake in its batch function, similar to an attack on a forked project days earlier.
- The attacker bypassed a safety flag meant to check if borrowers had enough collateral and drained six Cauldrons in one go before swapping the stolen MIM for ETH and routing it through Tornado Cash.
- This isn’t the first time Abracadabra’s code has been targeted, but the incident highlights how a small unimplemented function can let hackers take advantage, even when the same flaw was visible in a fork.
In early October, Abracadabra, a DeFi lending protocol that lets people borrow its stablecoin MIM using deposited tokens as collateral and suffered multiple hacker attacks before, this time once again lost about $1.8 million after an attacker used a simple logic mistake in the protocol’s batch function to borrow without putting up any collateral, in the same way a forked project had been hit just days before, analysts at blockchain security firm Hacken said in a research note shared with crypto.news.
Abracadabra launched as a way for people to use interest-bearing tokens as collateral and borrow a U.S. dollar-pegged token called Magic Internet Money, or MIM. The system is built around two pieces: Cauldrons, which handle the borrowing rules, and DegenBox, the shared vault that actually holds tokens. In short: you put up collateral in a Cauldron, and the DegenBox keeps track of the money behind the scenes.
The short version of what went wrong is this: a safety flag that’s supposed to force a final check on whether a borrower actually has collateral got turned off inside a single transaction. As Hacken
Go to Source to See Full Article
Author: Denis Omelchenko
